Method of verifiable and anonymous voter receipt for electronic voting system

ABSTRACT

A method of voting providing an anonymous, verifiable, audit-able, secure, and anti-rigging voter receipt with total secrecy and transparency, which is printed not only a voter&#39;s selections by filling a voter&#39;s UVNS, which comprises a Unique Voting Number and a voter Signature Letter, into one of selections of a ballot, but also some other voters&#39; selections filled with their UVNS in the rest of selections of the ballot; recorded by printing, or paperless digital recording, mobile text and/or emails; audited by third party; verifiable with a result of an election published after the election ends by any voter; utilized on electronic voting system connected with a local network at a polling station, mobile network or internet from anywhere.

FIELD OF THE INVENTION

The present invention relates to a method for electronic voting systemto produce a verifiable and anonymous voter receipt.

BACKGROUND

The modern democratic system requires a free and fair election. Alongwith development of the democratic and technological changes, peoplehave been trying to find more efficient tools and better ways in helpingwith the voting and counting system. From mechanical voting machines toelectronic voting machines to the Internet voting machine system, we seethat there are a number of different voting machine systems in theworld, however, the result still being dissatisfaction and a deeperdistrust to these kinds of electronic voting machines especially wherewireless equipment is involved. Right now, there are two basic kinds ofelectronic voting systems in the world, direct-recording electronic(DRE) voting machine and Optical Scan (OS) voting system. However, theproblem with both of these is untraceable and unverifiable once castinga ballot, with no one knowing if his/her vote has been changed, countedor spoiled. Fraud may happen because of lack of transparency. So far,almost any kind of EV (electronic voting) system leaves manypossibilities of being attacked through hacking or a virus. In theory,hundreds of thousands of possibilities could manipulate existing EVsystems no matter how secure they are. Ironically, the higher thetechnology applied on an EV system, the more possibilities to be rigged.Indeed, the problem is not because of the technology but lack oftransparency and auditing. This is the most concerning about the modernEV systems. How to balance the transparency and secrecy is the keyissue.

Looking back on previous elections over the years, voters only needed tolift and count their hands. It is a simple, transparent and audit-ablesystem but lack secrecy, therefore voters may be under pressure to vote,and in extreme cases easy to buy and sell votes. Then for secrecyreasons, developed to cast stone or paper ballot in a black box. It keptsecret, however fraud may happen because no one knows where his/her votegoes after casting. Using paper voting with voter signature could causeanother problem with secrecy once again. Also, along with the increasednumber of voters, better and more efficient tools and ways were neededto count the votes. Unfortunately, these counting tools and ways mightcause fraud as well. Even up to recent elections, we are still facedwith similar problems. Finding a way in keeping both privacy andtransparency in an election is the ultimate goal.

Free vote needs secrecy, anonymity and privacy. Fair voting needstransparency to show all votes have been accurately counted.Transparency can eliminate rigging, fraud and manipulation which couldhappen by stealing, bribery, buying/selling votes, hacking the EVsystem, spoiling or destroying votes, adding residual votes to favourtheir candidate(s) etc.

In almost all existent voting systems including direct-recordingelectronic voting and optical scan voting system, some have notransparency, while others lack secrecy. This may lead to fraud ormanipulation. Many problems, disputes and unfairness have happened evenin recent elections. The consequences could lead to political and socialunrest and chaos. Not to mention the financial loss if a nationalgeneral election failed. Another problem being if the election is stillfair, the loosing candidate may have feelings of uncertainty anddistrustful to the EV system and requires recounting.

SUMMARY OF THE INVENTION

The disclosure method of voter receipt has both features of transparencyand secrecy for an election. This method of voting selection does not bychecking mark(s) or punching hole(s) on a ballot but by filling a UVNS(Unique Voting Number with a voter Signature letter) in a selectionsection of a ballot as a voter's vote. The UVN (Unique Voting Number)randomly generated by EV system, and the voter Signature letter pickedup by a voter amongst at least two group of letters, numbers,characters, any kind of patterns, symbols and/or colours which aregenerated by EV system as well. If there are several elections on oneballot, for example, President Election, Senator Election and Amendmentvote, therefore this election has 3 categories. Each category has it'sown category letter, number or symbol in a UVNS. The UVN is a uniquevote number which is exclusively assigned once to one voter in oneselection. The Signature letter is to prevent a UVN from being assignedto another voter again. If a EV system assigns the same UVN to anothervoter who might choose a different voter signature letter from theprevious voter, when the result of election is published, two same UVNbut different voter signature letters would show on the result ofelection spreadsheet. If this happens, then the EVM system has aproblem. One UVNS is only for one voter exclusively used as oneselection by filling in one of selection sections on a ballot in oneelection event.

If there are multiple candidate election, to keep anonymous every votermust be assigned as many UVNS as required election number of candidates.By a software program of EV system, these UVNS have to be filled indifferent select sections on a ballot. To design a ballot for multiplecandidates selection, it requires as many “Write In” as the number ofrequired election candidates. So does “Abandon”. Once select “Write In”the voter then types in EV system and signs, or writes on a paper andsigns depending on how to balance transparency, secrecy and security,which needs to be determined by election commitment. For anonymousreasons if a voter selects “Write In”, his/her voter receipt does notshow the name of his/her write in candidate but only shows his/her UVNSselection under “Write In”.

After casting, a EV system generates at least two identical copies of aVAVR (Verifiable and Anonymous Voter Receipt). The voter gets one copy,and the system keeps another copy as verification. If there is anauditing organization involved, then the EV system has to send anothercopy to the auditing organization as well. The voter receipt can beprinted, digitally recorded, texted or emailed.

The VAVR shows not only a voter's selection but some other voters'selections filled in the rest of a ballot as well. Actually, the voter'sUVNS seems embedded in some other voters' UVNS on the receipt. Bychecking the receipt, no one else can distinguish which UVNS is thisvoter's except the voter himself/herself. In this way, the VAVR is asecrecy receipt. For further secrecy, the EV system may also duplicate acopy of another voter receipt for a voter. therefore no one would knowwhich copy is this voter's except the voter himself/herself.

With this method of VAVR, any voter is not able to sell his/her votebecause the voter is not able to make other people fully believe whichcopy or which selection of the receipt is this voter's. With thismethod, no voters need to be intimidated or bribed into voting becauseno one else can know the voter's selection.

Polling Place & EV System

The election can be held at polling stations, on the internet or amobile network EV system at any place. The present method is based oneligible voter voting. To those people who are disqualified to vote ordo not show on an eligible voter list, will then go to a previsionvoting station or onto a prevision voting website on the internet tovote. The prevision vote also can use this method too, but the votereceipt is marked as a prevision group and category, counted andpublished separately. They still can check their prevision votes in thesame way. If any one in the prevision group can prove he/she is aneligible voter late before a final due time, he/she can move to theeligible voter list and registered voter list and his/her vote then willbe counted. How to register and how to identify a voter are beyond thismethod.

With this method, hackers may ruin the system but are unable tomanipulate the election without leaving traces. Also, the manufacturerof the EV system does not have the capability to manipulate the EVsystem either because of the transparency of both hardware and software.

Results & Verification

After the election ends, the results of the election have to bepublished. The published results of the election primarily consists ofan eligible voter list, a registered voter list, a public register voterlist which may be the same as the registered voter list or may onlycontain a minimal amount of voters' information for private reason, ageneral election result spreadsheet filled with all UVNS, a VAVR Listfor searching and verifying and all voter receipts issued by a EVsystem. Meanwhile, a copy of a package of the Results is sent to thethird party for auditing. For privacy reason, eligible voter list andregister voter list may not be allowed public viewing, but must allowparty agents to check and verify all information. All voters can checkPublic registered voter list and all voter receipts via VAVR List.

Criteria & Fixability

To ensure an election is fair with this method, the EV system needs:

1. Any voter can check and verify any voters' VAVR;2. All UVNS must be unique numbers;3. All voters' UVNS accurately match to the Election Result;(If a voter forgets his/her UVNS, the voter still can check all UVNS ofhis/her VAVR. If all these UVNS accurately match to the Election Result,the voter's vote has been counted.)4. Every voter gets the same number of votes in one election. So, thetotal number of the registered voters must equal to the total number ofvoter receipts and equal to the total number of UVNS under one personone vote in one election with one selection;5. However, under this method if it is a multiple candidate election,for example, election two candidates, every voter has two vote rights bybeing assigned two UVNs to fill in two different election sections on agiven ballot. In this case, the total number of UVNS on the publishedresult spreadsheet must equal to 2 times of registered voters;6. All registered voters are amongst the eligible voter list;7. Any voter can check his/her any personal information via PublicRegistered Voter List;8. Third audit party or a non-partisan and Independent electoralmanagement body can check and monitor all datas and information in theEV system and voting centre.

In today's network environment, it's impossible to totally eliminate allhacking, fraud or manipulation within the network systems. However, withthis method, in case a EV system is hacked, or software virus happens,it will leave some traces. There are always some one can see theproblem. Therefore, the problem can be tracked or fixed. For example, ifa voter found his/her vote has been changed or missing, the voter canreport. If it is true, the vote can be changed back; If a partial dataof votes stored in a EV system are changed or damaged, it still canaccurately count the percentage of these bad votes. If the percentage ofthe bad votes are under tolerant rates by election law, or If all thebad votes add on to any lower vote candidate but still lower than thehighest votes candidate in a plurality voting, the result should stillbe legal. In the worst scenario, it still has a chance to recover bymanual counting of all VAVR. Therefore, by running this method, the EVsystem is fairer, securer and more efficient than the same EV system byrunning any other conventional methods.

BRIEF DESCRIPTION OF THE DRAWINGS

The present method of Verifiable and Anonymous Voter Receipt (VAVR) willbe apparent with references to the following descriptions and drawings,wherein:

FIG. 1 is a typical hardware of EV system 100 on which the method ofVAVR can be applied on,

FIG. 2 is a typical software schematics running in the EV system.

FIG. 3 illustrates an election running with an EV system using themethod of VAVR.

FIG. 4 is a typical format of UVNS.

FIG. 5 is a sample of VAVR.

FIG. 6 is a sample of a list of VAVR.

FIG. 7 is a sample of a general election result spreadsheet forPresident Election in category A.

FIG. 8 is a sample of a general election result spreadsheet for SenatorElection result in category B.

FIG. 9 is a sample of a general election result spreadsheet forAmendment Vote result in category C.

FIG. 10 is a sample of an eligible voter list

FIG. 11 is a sample of a registered voter list.

FIG. 12 is a sample of a public registered voter list.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 is a typical hardware of EV system 100 which the method of VAVRcan be applied to, the voting centre 105 is a voting head quarter forstore eligible voter list, registered voter list, public registeredvoter list, collecting voting data and information from electronicvoting (EV) server 120 located in different polling stations 115,116 andmore, sending all information to third party 110 for auditing. The EVserver 120 connects several electronic voting machines 135 whichattaches with printer 140 by local network or internet 130. The EVserver 120 also attaches with digital recorder and sends text and emailreceipt 125 to voters.

FIG. 2 is a typical software schematics 200 running in the EV system100. The first bloke 202 is registration. Any voter must be in aneligible voter list and get a permission to use a voting machine with anauthorized means or a password at block 205 to access the EVM. If EVMaccept the voter to vote, go to start election at block 215, otherwisego back to block 202. Once start vote at block 215, the EVM display anempty ballot and explain how to vote. Then, go to the next block 210,the EVM randomly picks up a Unique Voter Number (UVN) in the EV systemUVN database. The UVN is exclusively used for one voter. The EV systemcan't assign the same UVN again. To lock this number won't be change ormissing during the voting, it need to be recorded by printing down on abackup sheet or recording which is read-only. Then go to the next block220, the EVM randomly picks up at least two numbers, letters, patens ina voter Signature Letter (SL) database. Then go to block 225 to let thevoter pickup one. Once the voter confirms his/her pickup at block 230,the SL needs to be recorded and/or printed as well at block 235. Thisvoter SL attached onto the UVN to be a UVNS which is only for one voter,uses as one selection in one ballot. The voter uses this UVNS forselection in the first category if the ballot has more then one electioncategory. The voter fill this UVNS to select a candidate, Write-in orAbandon at block 240, then to confirm his/her selection at block 245. Ifok, go to the block 250. If having more selections in this category ofthe ballot, the EVM drives back to produce another UVNS, following thesame procedural staring from block 210 until all elections finished inthis category. Then go to the block 255 to see if have more categoryneeded election. If having more category, go to the next category atblock 260 and back to block 210. Following the same process staring fromblock 210 until all elections and categories finished. Then go to theblock 265 to show the voter's all selections to see if all selectionsare correct at block 270. If not correct, go to the block 272 to adjustthe selections. Any selection changing by moving UVNS, which can only bemoved in the same category. If all Ok, cast the ballot and print atleast two copies of Verifiable and Anonymous Voter Receipt (VAVR) atblock 275. One copy is for the voter and another copy is kept forverification and auditing. The VAVR at block 275 also can be paperlessdigital recorded. The VAVR is not only printed the voter's selection butother voters' rest selections of the ballot, therefore, no one knowswhat is this voter's selection. Before leaving, check the VAVR receiptat block 280. The voter only needs to check his/her selection(s)regardless all other voter's selections on the printed VAVR. If wrong,call poll worker at block 285 to let them check your selections andbackup sheet, record and final cast ballot. It is easy to figure outwhat's the problem because every step recorded. If the VAVR is correct,confirm and go to the block 290, the EV system shred the backup sheet toclean up the record for secret reason, and sends the VAVR to the votervia text and/or email. Then the EVM runs to the end at block 295. TheEVM goes back to 202 and ready for the next voter to vote.

FIG. 3 illustrates an election running with a EV system by using theVerifiable and Anonymous Voter Receipt (VAVR) 300.

Voting Centre 310 stores a eligible voter list, collects register voterlist from polling station registrations 325, sends permission passwordto allow the qualified voter using a VM, collects casted ballots from VM320, sends copy of election results to third party audit centre 315.Before voting, any voter must shows his/her ID to register If qualify tovote, the voter gets an authorization permission by Voting Centre 310 touse VM 320. After casting his/her ballot, the voter gets a VARV 330. TheVoting Centre 310 publishes all results including a VAVR list and anelection result spreadsheet, with which, the voter can verify his VAVRto see if his/her vote has been counted or not. When a voter leaves thepoll place 340 by checking out, the ID information sends to auditingcentre 315 to verify the check in information stored in Voting Centre,both ID information must match. There are many way to check in. How toCheck In and Check Out are beyond to this method. This is just onepossible way to secure eligible voters.

FIG. 4 is a format of UVNS 400. the UVNS basically consists of twoparts. The first part 415 is a unique number randomly picked up by a EVsystem from a UVN database. The UVN 415 is exclusively assigned to onevoter. The second part is a voter signature letter picked up by a voter,which can be a number, patten or letter 420. If have more than oneelection category in one election event, attach a category part toidentify the election category, which can be a number, patten or letter410. These three parts can be combined to form as any kind of format.for example, the category letter can put to the right, or VoterSignature Letter put to the left, or UVN put to the left, as long as thesame format of UVNS in one election ballot.

FIG. 5 is a sample of a VAVR (verifiable and anonymous voter receipt)500, which contains an election events 502, election date 505, electiondistraction 510, polling division 515, VAVR number 520, and a barcode or2D barcode 545 for quick check the receipt. As a sample, there are threeelection categories. Category A 525 is for president election; categoryB 565 is for senator election and category C 590 is for Amendmentvoting.

Category A for president election only has one selection in severalcandidates 530, Write-In 540 and Abandon 550.

The category B 565 is senator election which needs to elect more thanone candidate from several candidatures 570. Here is an example ofelecting 2 candidates. There are 2 Write-In 575 and 2 Abandons 580.

The category C 590 is an amendment voting, which needs to select Yes595, No or Abandon.

In category A the UVNS attaches an “A” 560. Same as category B attachesa “B” 585, and category C attaches a “C” 597.

If this voter's UVNS has, for example, A-748345-G in category A,B-39879-S and B-3108936-& in category B, and C-4028331-# in category C.When the voter checks a VAVR 500 with the election result, his/her UVNSare under Candidate2 of president, Candidate1 and Write(2) of Senator,and Abandon of Amendment. All other selections are some other unknownvoter's UVNS, and these UVNS should match the result as well.

FIG. 6 is a sample of a public list of Verifiable and Anonymous VoterReceipts VAVR 600, which shows the election events 605, election date610, polling division 615, polling division 620, public VAVR list 625.The public VAVN list contains all VAVR series number 630, VAVR number635 by ascending or descending which is a gateway for a voter to checkhis/her email address 640. What kind of personal information, such asname, gander, age, address, phone # or voter email address and uniqueidentification is depend on what kind of privacy level required. Thetotal number of VAVN 650 should be equal to the total votes.

FIG. 7 is a sample of a general election result spreadsheet for categoryA 700. It shows Election events 710, Election date 720, Electoraldistrict 725, Polling division 730, election result 735 for category A740.

The general election result spreadsheet contains candidates 747,Write-In and Abandon. The subtotal votes 750 of each candidate shows onthe bottom line. The Total votes 770 should equal to total number ofVAVN 650 because every voter has one selection in Category A.

FIG. 8 is a sample of an election result spreadsheet for category B 800.It contains Election events 810, election date 815, senator election820, election distract 825, polling division 830 and election result forCategory B 835.

The result spreadsheet shows all candidate votes on the bottom assubtotal number 860. The top two rankings here are Candidate1 840 andCandidate3 845. The senator election of category B is a multi election.This election needs two winners. So each voter has two UVNS toselections in category B. Therefore, the total vote number 870 shouldequal to 2 times total number of VAVN 650.

FIG. 9 is a sample of an election result spreadsheet for category C 900.It shows voting events 910, voting date 915, the name of voting 920,electoral distract 925, polling division 930 and voting category C 935.

The result of amendment shows “Yes” 940, “No” 945 and “abandon” 950.Subtotal votes 955 on the bottom. Total votes 960 should equal to thetotal number of VAVR 650 because every voter has one vote for categoryC.

FIG. 10 is a sample of an eligible voter list 1000. It shows an electionevents 1010, election date 1015, election district 1020, pollingdivision 1025. The eligible voter list contains voter's personalInformation, for example, voter name 1040, date of birth 1045, gender1050, residential address 1055, mailing address 1060, official emailaddress 1065, private email address 1067, cell phone number 1070, uniqueID 1075. Series number 1035 from 1st to the last voter 1080 which showsthe total eligible voters. All official email address 1065 might beassigned by voting centre, which are only used for receiving VAVR andpersonal information. The private email address 1067 may sendingelection news and notice notices. The cell phone number 1070 is forreceiving text VAVR and personal information. The unique identification1075 is for registration checking in.

FIG. 11 is a sample of a Registered Voter List 1100. It is the sameformat as the eligible voter list. All voters in the Registered VoterList must be in the eligible voter list 1000. The last SN 1110 is Thetotal number of registered voters who take part in the election.

FIG. 12 is a sample of a public Register Voter List 1200. It containsminimal information of the Register Voter List 1100 for privacy reason.The more information shows up, the more transparency. How to balancetransparency and privacy is totally up to election commitment.

1. A method of voting providing an anonymous, verifiable, audit-able,secure, and anti-rigging voter receipt with total secrecy andtransparency, which is printed not only a voter's selection by filling avoter's UVNS, which comprises a Unique Voting Number and a voterSignature letter, into one of selections of a ballot, but also someother voters' selections filled with their UVNS in the rest ofselections of the ballot; recorded by printing, or paperless digitalrecording, mobile text and/or emails; audited by third party; verifiablewith a result of an election published after the election ends by anyvoter; utilized on electronic voting system connected with a localnetwork at a polling station, mobile network or internet from anywhere.2. Said method of voting of claim 1 can be applied to any electronicvoting system or electronic survey system for all voters to vote andverify their voting after an election or survey closed with their voterreceipts.
 3. The method of claim 1, wherein said UVNS comprises a UniqueVoter Number and a Voter Signature letter.
 4. The method of claim 3,wherein said Unique Voter Number is a series digital number and/orletter(s) randomly generated by the electronic voting system.
 5. Themethod of claim 3, wherein said Unique Voter Number is only assignedonce to only one voter for one election by the electronic voting system.6. The method of claim 4, wherein said series digital number and/orletter(s) can be either digital number only, letter(s) only, orattaching together.
 7. The method of claim 3, wherein said VoterSignature letter is picked up by a voter in at least two groups ofnumber(s), letter(s) or symbol(s).
 8. Said groups of number(s) of claim7 are randomly generated by the electronic voting system.
 9. Saidletter(s) of claim 7 are randomly generated by the electronic votingsystem.
 10. Said symbol(s) of claim 7 are randomly generated by theelectronic voting system.
 11. The method of claim 7, wherein number(s)can be any digit(s).
 12. The method of claim 7, wherein letter(s) can beone or more letters.
 13. The method of claim 7, wherein symbol(s) can beany patten or colour.
 14. The method of claim 1, wherein said ballot cancomprise but not limited to the following elements which are the name ofelection event, polling place, voting date and time, a ballot seriesnumber, all candidates, Write-In, Yes/No, Abandon and all blank electionsections.
 15. The method of claim 14, wherein said Write-In allows avoter to vote his or her favourite candidate who's name does not appearon the ballot.
 16. The method of claim 14, wherein said blank electionsections are allowed to be filled out with a voter's UVNS as his/hervote selection.
 17. The method of claim 1, wherein said voter receipt isa recorded ballot in which all election sections are fully filled withnot only a voter's selection but also some other voters' selections aswell.
 18. Said recorded ballot of claim 17 either can be a paper receiptprinted by a printer or a paperless receipt recorded on digital memory,mobile text and/or email.
 19. Said digital memory of claim 18 can be amemory cartridge, memory USB stick, hard drive or any other means torecord the data.
 20. The method of claim 1, wherein said third party isa neutral organization or system for an election or survey.
 21. Thethird party is responsible for monitoring, checking and keeping all theelection data and voters' receipts safe preventing loss or change ofdata during and after election. 22, The third party would supply anothertool for verification of election results and also check voter receiptsby any party and any voter.
 23. The method of claim 1, wherein theresult of election consists of at least one general election resultspreadsheet, a list of all voter receipts, an eligible voter list, aregistered voter list, and a public registered voter list.
 24. Themethod of claim 23, wherein general election result spreadsheet displaysall voters' selections in a given election which must exactly match allvoters' UVRS.
 25. There is a ballot series number, bar code and/or 2Dcode on the voter receipt of claim
 1. 26. The method of claim 23,wherein said list of all voter receipts can be searched and verifiedwith a ballot series number, bar code or 2D code for any voter.
 27. Themethod of claim 23, wherein an eligible voter list is a list of allpeople who have a right to take part in the election or survey.
 28. Theeligible voters list consist of partial or all eligible voters' personalinformation, such as the name, address, birth date, any personal ID,and/or biology Identification information etc.
 29. The method of claim23, wherein a registered voter list is a name list of eligible voterswho have registered to vote in an election or survey event.
 30. Theregistered voter list consists of partial or all registered voters'personal information such as the name, address, birth date, any personalID, and/or biology Identification information etc.
 31. The method ofclaim 1, wherein said the result of election needs to be sent to a thirdparty for auditing if the third party is set up. 32, The electronicvoting system consists of one or more voting devices connected to anetwork.
 33. The method of claim 1, wherein electronic voting system isoperated with a voting software.
 34. Said voting software of claim 33can be either a hidden or an open code to all parties.
 35. The votingcan take place in a polling station by using an electronic voting systemconnected to a local network.
 36. The voting can take place anywhere byusing an electronic voting system via internet or mobile network. 37.There is a sub total vote count of each individual candidate and otherelection options on the general election result spreadsheet.
 38. Thereis also a total election vote on the general election resultspreadsheet.
 39. The method of claim 38, wherein said total electionvotes should be equal to the total number of the registered voters. 40.The total election votes should also be equal to the final number of allvoter receipts.